GoogleCloudPlatform · melinath · Sep 9, 2026
diff --git a/mmv1/products/networkservices/AgentConnectivityTemplate.yaml b/mmv1/products/networkservices/AgentConnectivityTemplate.yaml
@@ -0,0 +1,170 @@
+---
+name: AgentConnectivityTemplate
+description: |
+  AgentConnectivityTemplate represents a reusable network configuration.
+references:
+  guides:
+  api: https://cloud.google.com/network-services/docs/reference/network-services/rest/v1/projects.locations.agentConnectivityTemplates
+docs:
+base_url: projects/{{project}}/locations/{{location}}/agentConnectivityTemplates
+self_link: projects/{{project}}/locations/{{location}}/agentConnectivityTemplates/{{agent_connectivity_template_id}}
+create_url: projects/{{project}}/locations/{{location}}/agentConnectivityTemplates?agentConnectivityTemplateId={{agent_connectivity_template_id}}
+update_mask: true
+update_verb: PATCH
+import_format:
+  - projects/{{project}}/locations/{{location}}/agentConnectivityTemplates/{{agent_connectivity_template_id}}
+timeouts:
+  insert_minutes: 30
+  update_minutes: 30
+  delete_minutes: 30
+async:
+  type: OpAsync
+  operation:
+    base_url: '{{op_id}}'
+  actions: [create, delete, update]
+  result:
+    resource_inside_response: true
+autogen_status: QWdlbnRDb25uZWN0aXZpdHlUZW1wbGF0ZUF1dG9nZW5WMkFnZW50
+autogen_async: true
+error_retry_predicates:
+  - transport_tpg.IsAgentGatewayInUseError
+samples:
+  - name: network_services_agent_connectivity_template_basic
+    primary_resource_id: default
+    steps:
+      - name: network_services_agent_connectivity_template_basic
+        resource_id_vars:
+          agent_connectivity_template_id: my-connectivity-template
+        test_env_vars:
+          project: PROJECT_NAME
+      - name: network_services_agent_connectivity_template_basic_update
+        resource_id_vars:
+          agent_connectivity_template_id: my-connectivity-template
+        test_env_vars:
+          project: PROJECT_NAME
+  - name: network_services_agent_connectivity_template_advanced
+    primary_resource_id: default
+    steps:
+      - name: network_services_agent_connectivity_template_advanced
+        resource_id_vars:
+          agent_connectivity_template_id: my-connectivity-template
+          network_name: my-network
+          subnetwork_name: my-subnetwork
+          network_attachment_name: my-attachment
+          dns_zone_name: my-zone
+        test_env_vars:
+          project: PROJECT_NAME
+      - name: network_services_agent_connectivity_template_advanced_update
+        resource_id_vars:
+          agent_connectivity_template_id: my-connectivity-template
+          network_name: my-network
+          subnetwork_name: my-subnetwork
+          network_attachment_name: my-attachment
+          dns_zone_name: my-zone
+        test_env_vars:
+          project: PROJECT_NAME
+parameters:
+  - name: agentConnectivityTemplateId
+    type: String
+    description: |
+      Short name of the AgentConnectivityTemplate resource.
+    required: true
+    url_param_only: true
+    immutable: true
+  - name: location
+    type: String
+    description: |
+      The location of the AgentConnectivityTemplate.
+    url_param_only: true
+    required: true
+properties:
+  - name: name
+    type: String
+    description: |
+      Identifier. Name of the resource.
+    output: true
+  - name: createTime
+    type: Time
+    description: |
+      The timestamp when the resource was created.
+    output: true
+  - name: updateTime
+    type: Time
+    description: |
+      The timestamp when the resource was updated.
+    output: true
+  - name: labels
+    type: KeyValueLabels
+    description: |
+      Set of label tags associated with the AgentConnectivityTemplate resource.
+  - name: description
+    type: String
+    description: |
+      A free-text description of the resource. Max length 1024 characters.
+  - name: etag
+    type: Fingerprint
+    description: |
+      Etag of the resource.
+      If this is provided, it must match the server's etag. If the provided etag
+      does not match the server's etag, the request will fail with a 409 ABORTED
+      error.
+  - name: accessTypes
+    type: Array
+    default_from_api: true
+    description: |
+      The types of network access provided to the gateway.
+      Both PUBLIC and PRIVATE can be configured.
+    item_type:
+      type: Enum
+      enum_values:
+        - PUBLIC
+        - PRIVATE
+  - name: accessPath
+    type: Enum
+    required: true
+    immutable: true
+    description: |
+      The path of the access.
+      The path is immutable once set. Exactly one path can be set.
+    enum_values:
+      - CLIENT_TO_AGENT
+      - AGENT_TO_ANYWHERE
+  - name: egressNetworkConfig
+    type: NestedObject
+    description: |
+      Configuration for egress network traffic.
+    properties:
+      - name: networkAttachment
+        type: String
+        immutable: true
+        description: |
+          The network attachment resource name.
+          Format: projects/{project}/regions/{region}/networkAttachments/{network_attachment_id}
+        diff_suppress_func: tpgresource.CompareSelfLinkOrResourceName
+      - name: dnsPeeringConfig
+        type: NestedObject
+        description: |
+          DNS peering configuration for the AgentConnectivityTemplate.
+          When set, the gateway will resolve queries for the configured
+          `domain` via Cloud DNS in the specified `targetNetwork`.
+        properties:
+          - name: domain
+            type: String
+            required: true
+            description: |
+              The domain name to peer for DNS resolution. Must be a fully
+              qualified domain name ending with a dot (for example, `example.com.`).
+          - name: targetNetwork
+            type: String
+            required: true
+            diff_suppress_func: tpgresource.CompareSelfLinkOrResourceName
+            description: |
+              The URI of the target VPC network for DNS peering. Must be of the
+              form `projects/{project}/global/networks/{network}`.
+      - name: vpcEgress
+        type: Enum
+        description: |
+          The VPC egress setting.
+        enum_values:
+          - ALL_TRAFFIC
+          - PRIVATE_RANGES_ONLY
diff --git a/mmv1/products/networkservices/AgentGateway.yaml b/mmv1/products/networkservices/AgentGateway.yaml
@@ -163,6 +163,13 @@ properties:
       `//agentregistry.googleapis.com/{version}/projects/{{project}}/locations/{{location}}`
     item_type:
       type: String
+  - name: agentConnectivityTemplate
+    type: String
+    diff_suppress_func: tpgresource.ProjectNumberDiffSuppress
+    description: |
+      The resource name of the AgentConnectivityTemplate.
+      Must be of format
+      `projects/{{project}}/locations/{{location}}/agentConnectivityTemplates/{{agent_connectivity_template}}`
   - name: networkConfig
     type: NestedObject
     description: |

diff --git a/...es/services/networkservices/network_services_agent_connectivity_template_advanced.tf.tmpl b/...es/services/networkservices/network_services_agent_connectivity_template_advanced.tf.tmpl
@@ -0,0 +1,51 @@
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name                    = "{{index $.ResourceIdVars "network_name"}}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "default" {
+  name          = "{{index $.ResourceIdVars "subnetwork_name"}}"
+  region        = "us-central1"
+  network       = google_compute_network.default.id
+  ip_cidr_range = "10.0.0.0/16"
+}
+
+resource "google_compute_network_attachment" "default" {
+  name                  = "{{index $.ResourceIdVars "network_attachment_name"}}"
+  region                = "us-central1"
+  connection_preference = "ACCEPT_AUTOMATIC"
+  subnetworks           = [google_compute_subnetwork.default.id]
+}
+
+resource "google_dns_managed_zone" "default" {
+  name        = "{{index $.ResourceIdVars "dns_zone_name"}}"
+  dns_name    = "example.com."
+  description = "Private zone used by AgentGateway DNS peering"
+  visibility  = "private"
+
+  private_visibility_config {
+    networks {
+      network_url = google_compute_network.default.id
+    }
+  }
+}
+
+resource "google_network_services_agent_connectivity_template" "{{$.PrimaryResourceId}}" {
+  agent_connectivity_template_id = "{{index $.ResourceIdVars "agent_connectivity_template_id"}}"
+  location                       = "us-central1"
+  description                    = "An advanced configuration for Agent Connectivity Template"
+
+  access_types = ["PRIVATE"]
+  access_path = "AGENT_TO_ANYWHERE"
+
+  egress_network_config {
+    vpc_egress = "ALL_TRAFFIC"
+    network_attachment = google_compute_network_attachment.default.id
+    dns_peering_config {
+      domain         = google_dns_managed_zone.default.dns_name
+      target_network = google_compute_network.default.id
+    }
+  }
+}
diff --git a/...ices/networkservices/network_services_agent_connectivity_template_advanced_update.tf.tmpl b/...ices/networkservices/network_services_agent_connectivity_template_advanced_update.tf.tmpl
@@ -0,0 +1,55 @@
+data "google_project" "project" {}
+
+resource "google_compute_network" "default" {
+  name                    = "{{index $.ResourceIdVars "network_name"}}"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "default" {
+  name          = "{{index $.ResourceIdVars "subnetwork_name"}}"
+  region        = "us-central1"
+  network       = google_compute_network.default.id
+  ip_cidr_range = "10.0.0.0/16"
+}
+
+resource "google_compute_network_attachment" "default" {
+  name                  = "{{index $.ResourceIdVars "network_attachment_name"}}"
+  region                = "us-central1"
+  connection_preference = "ACCEPT_AUTOMATIC"
+  subnetworks           = [google_compute_subnetwork.default.id]
+}
+
+resource "google_dns_managed_zone" "default" {
+  name        = "{{index $.ResourceIdVars "dns_zone_name"}}"
+  dns_name    = "example.com."
+  description = "Private zone used by AgentGateway DNS peering"
+  visibility  = "private"
+
+  private_visibility_config {
+    networks {
+      network_url = google_compute_network.default.id
+    }
+  }
+}
+
+resource "google_network_services_agent_connectivity_template" "{{$.PrimaryResourceId}}" {
+  agent_connectivity_template_id = "{{index $.ResourceIdVars "agent_connectivity_template_id"}}"
+  location                       = "us-central1"
+  description                    = "An updated advanced configuration for Agent Connectivity Template"
+
+  access_types = ["PRIVATE"]
+  access_path = "AGENT_TO_ANYWHERE"
+
+  labels = {
+    env = "prod"
+  }
+
+  egress_network_config {
+    vpc_egress = "PRIVATE_RANGES_ONLY"
+    network_attachment = google_compute_network_attachment.default.id
+    dns_peering_config {
+      domain         = google_dns_managed_zone.default.dns_name
+      target_network = google_compute_network.default.id
+    }
+  }
+}
diff --git a/...mples/services/networkservices/network_services_agent_connectivity_template_basic.tf.tmpl b/...mples/services/networkservices/network_services_agent_connectivity_template_basic.tf.tmpl
@@ -0,0 +1,13 @@
+data "google_project" "project" {}
+
+resource "google_network_services_agent_connectivity_template" "{{$.PrimaryResourceId}}" {
+  agent_connectivity_template_id = "{{index $.ResourceIdVars "agent_connectivity_template_id"}}"
+  location                       = "us-central1"
+  description                    = "A basic configuration for Agent Connectivity Template"
+  labels = {
+    env  = "test"
+    tier = "gold"
+  }
+
+  access_path = "CLIENT_TO_AGENT"
+}
diff --git a/...ervices/networkservices/network_services_agent_connectivity_template_basic_update.tf.tmpl b/...ervices/networkservices/network_services_agent_connectivity_template_basic_update.tf.tmpl
@@ -0,0 +1,13 @@
+data "google_project" "project" {}
+
+resource "google_network_services_agent_connectivity_template" "{{$.PrimaryResourceId}}" {
+  agent_connectivity_template_id = "{{index $.ResourceIdVars "agent_connectivity_template_id"}}"
+  location                       = "us-central1"
+  description                    = "An updated configuration for Agent Connectivity Template"
+  labels = {
+    env  = "prod"
+    tier = "platinum"
+    new_label = "added"
+  }
+  access_path = "CLIENT_TO_AGENT"
+}
diff --git a/...es/terraform/samples/services/networkservices/network_services_agent_gateway_full.tf.tmpl b/...es/terraform/samples/services/networkservices/network_services_agent_gateway_full.tf.tmpl
@@ -14,22 +14,12 @@ resource "google_network_services_agent_gateway" "{{$.PrimaryResourceId}}" {
     governed_access_path = "AGENT_TO_ANYWHERE"
   }
 
+  agent_connectivity_template = "projects/${data.google_project.project.number}/locations/us-central1/agentConnectivityTemplates/${google_network_services_agent_connectivity_template.default.agent_connectivity_template_id}"
+
   registries = [
     "//agentregistry.googleapis.com/projects/{{index $.TestEnvVars "project"}}/locations/us-central1"
   ]
 
-  network_config {
-    egress {
-      network_attachment = google_compute_network_attachment.default.id
-    }
-
-    dns_peering_config {
-      domains        = [google_dns_managed_zone.default.dns_name]
-      target_project = data.google_project.project.project_id
-      target_network = google_compute_network.default.id
-    }
-  }
-
   depends_on = [google_project_service.agent_registry]
 }
 
@@ -38,6 +28,26 @@ resource "google_project_service" "agent_registry" {
   disable_on_destroy = false
 }
 
+resource "google_network_services_agent_connectivity_template" "default" {
+  agent_connectivity_template_id = "{{index $.ResourceIdVars "name"}}-template"
+  location = "us-central1"
+  description = "A basic configuration for Agent Connectivity Template"
+  labels = {
+    env  = "test"
+    tier = "gold"
+  }
+
+  access_path = "AGENT_TO_ANYWHERE"
+
+  egress_network_config {
+    network_attachment = google_compute_network_attachment.default.id
+    dns_peering_config {
+      domain         = google_dns_managed_zone.default.dns_name
+      target_network = google_compute_network.default.id
+    }
+  }
+}
+
 resource "google_compute_network" "default" {
   name                    = "{{index $.ResourceIdVars "network_name"}}"
   auto_create_subnetworks = false
@@ -53,7 +63,7 @@ resource "google_compute_subnetwork" "default" {
 resource "google_compute_network_attachment" "default" {
   name                  = "{{index $.ResourceIdVars "network_attachment_name"}}"
   region                = "us-central1"
-  connection_preference = "ACCEPT_MANUAL"
+  connection_preference = "ACCEPT_AUTOMATIC"
 
   subnetworks = [
     google_compute_subnetwork.default.id,